CWE-295: Improper Certificate Validation
The product does not validate, or incorrectly validates, a certificate.
A kind of CWE-287 Improper Authentication.
From the CWE List. © The MITRE Corporation.
Newest
- red hat cert manager support for red hat openshift release 1.17, cert manager support for red hat openshift release 1.18, cert manager support for red hat openshift release 1.20 +32 more +34 moreGnutls: gnutls: security bypass due to incorrect name constraint handling7.4 High
- apache airflow, apache software foundation airflow providers smtp +1 moreApache Airflow Providers SMTP: No certificate validation on SMTP STARTTLS connections in SMTP provider5.9 Medium
- red hat cert manager support for red hat openshift release 1.17, cert manager support for red hat openshift release 1.18, cert manager support for red hat openshift release 1.20 +32 more +34 moreGnutls: gnutls: certificate validation bypass due to oversized subject alternative name8.2 High
- red hat cert manager support for red hat openshift release 1.17, cert manager support for red hat openshift release 1.18, cert manager support for red hat openshift release 1.20 +24 more +26 moreGnutls: gnutls: certificate validation bypass due to improper handling of uri and srv sans7.1 High
- ckanCKAN: No certificate validation on STMP connection6.6 Medium
- curlOCSP stapling bypass with Apple SecTrust5.3 Medium
- curlconnection reuse ignores TLS requirement5.9 Medium
- desktime time tracking app, draugiemgroup desktime time tracking +1 moreImproper TLS Certificate Validation RCE via Malicious Update in DeskTime Time Tracking App4.8 Medium
- spring boot, vmware spring boot +1 moreSpring Boot's Cassandra SSL auto-configuration disables TLS hostname verification5.0 Medium
- spring boot, vmware spring boot +1 moreSpring Boot's RabbitMQ auto-configuration doesn't perform hostname verification when connecting to the RabbitMQ broker5.0 Medium
- spring boot, vmware spring boot +1 moreSpring Boot's Elasticsearch auto-configuration doesn't perform hostname verification when connecting to the Elasticsearch server.5.0 Medium
- apache storm prometheus reporterApache Storm Prometheus Reporter: Disabling TLS verification for Prometheus Reporter also disables it for all other connections4.8 Medium
- spring security, vmware spring security, red hat openshift developer tools and services +11 more +13 moreUnauthorized User Impersonation when Using X.509 Client Certificates6.8 Medium
- nodejs undici, red hat cluster observability operator 1.5.0, cryostat 4 +21 more +23 moreundici vulnerable to TLS certificate validation bypass via dropped requestTls in SOCKS5 ProxyAgent7.4 High
- nodejs node, node.js +1 moreA flaw in Node.js TLS host verification can cause an attacker to bypass certification validation....4.3 Medium
- openbaoOpenBao's Certificate Authentication Allows Token Renewal With Different Certificate2.0 Low
- dell data domain operating system, powerprotect data domain, powerprotect dp series appliance +2 moreDell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release...7.2 High
- cisco webex meetingsCisco Webex Meetings Certificate Validation Vulnerability9.8 Critical
- oxia-db oxiaOxia: TLS CA certificate chain validation fails with multi-certificate PEM bundles6.9 Medium
- rustls webpkirustls webpki 0.101.0 before 0.103.12 Name Constraint Bypass2.1 Low
- rustls webpkirustls webpki Name Constraints URI Validation Bypass2.1 Low
- siemens software center, simcenter 3d, simcenter femap +5 more +7 moreA vulnerability has been identified in Siemens Software Center (All versions < V3.5.8.2),...6.3 Medium
- linuxfoundation sigstore timestamp authority, sigstore timestamp-authority +1 moreSigstore Timestamp Authority has Improper Certificate Validation in verifier5.5 Medium
- palo alto networks autonomous digital experience managerAutonomous Digital Experience Manager: Improper validation of ADEM certificate2.0 Low
- apache log4j, apache software foundation log4j core +1 moreApache Log4j Core: verifyHostName attribute silently ignored in TLS configuration, allowing hostname verification bypass6.3 Medium
- wolfsslImproper Certificate Signature Verification in X.509 Chain Validation Allows Forged Leaf Certificates8.6 High
- wolfsslURI nameConstraints not enforced in ConfirmNameConstraints()7.0 High
- wolfsslwolfSSL ECDSA Certificate Verification9.3 Critical
- linuxdeepin dde-control-center, deepin-deepinid-plugin +1 moredeepinid plugin in dde-control-center is configured to skip TLS certificate verification when downloading avatar from remote server5.4 Medium
- trailofbits rfc3161-clientImproper Certificate Validation in rfc3161-client6.2 Medium
- go standard library crypto/x509, golang go, red hat assisted installer for red hat openshift container platform 2 +103 more +105 moreCase-sensitive excludedSubtrees name constraints cause Auth Bypass in crypto/x5098.2 High
- go standard library crypto/x509, golang go +1 moreInefficient policy validation in crypto/x5097.5 High
- botan project botan, red hat enterprise linux 10 +1 moreBotan has a certificate authentication bypass due to trust anchor confusion9.3 Critical
- red hat multicluster engine for kubernetes, multicluster engine for kubernetes 2.1, multicluster engine for kubernetes 2.11 +4 more +6 moreRhacm: open cluster management (ocm): cross-cluster privilege escalation via improper kubernetes client certificate renewal validation8.2 High
- erlang otp, erlang\/otp, erlang\/public key +4 more +6 moreOCSP designated-responder authorization bypass via missing signature verification7.6 High
- bulwarkmail webmailBulwark Webmail S/MIME signature verification accepted self-signed certificates8.7 High
- amazon athena odbc driver, athena odbc +1 moreImproper certificate validation in identity provider connection components in Amazon Athena ODBC driver9.1 Critical
- seppmail secure email gatewayS/MIME Signature Additional Certificate7.7 High
github.com/teslamotors/fleet-telemetryGoTesla Fleet Telemetry allows spoofing telemetry for arbitrary vehicles via compromised vehicle credentials5.9 Medium- cisco nexus dashboardCisco Nexus Dashboard Configuration REST API Unauthorized Access Vulnerability6.5 Medium
- canonical jujuImproper TLS Client/Server authentication and certificate verification on Database Cluster10.0 Critical
- trustedfirmware mbed tlsMbed TLS v3.3.0 up to 3.6.5 and 4.0.0 allows Algorithm Downgrade.6.5 Medium
- apache software foundation airflow provider for databricks, apache airflow providers databricks +1 moreApache Airflow Provider for Databricks: TLS Certificate Verification Disabled in Databricks Provider K8s Token Exchange4.8 Medium
- botan project botanBotan: Case-Insensitive CN Values Bypass DNS excludedSubtrees Name Constraints (RFC 5280 Violation)5.9 Medium
- ubiquiti unifi network controllerUniFi Network Controller Improper Certificate Validation Leading to Credential Theft via MITM7.7 High
- cryptography.io cryptographycryptography has incomplete DNS name constraint enforcement on peer names1.7 Low
- wazuh, wazuh provisioning scripts (agent build environment) +1 moreWazuh Provisioning Scripts / Build Infrastructure Improper Certificate Validation leading to MITM and RCE6.3 Medium
- linuxcontainers incusIncus does not verify combined fingerprint when downloading images from simplestreams servers5.7 Medium
- digitalbazaar forge, red hat cluster observability operator 1.5.0, cryostat 4 +16 more +18 moreForge has a basicConstraints bypass in its certificate chain verification (RFC 5280 violation)7.4 High
- linuxfoundation nats-serverNATS has mTLS verify_and_map authentication bypass via incorrect Subject DN matching4.2 Medium
- Show moreLoading…